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DISA's  IW-D  Responsibilities 


Director  DISA: 


wiir’ensure  that  DISA  ArGhitectures  consider  EW,  ECCM,  CSCM" 

DODD  3222.4  Electronic  Warfare  (EW)  and 
Command,  Control,  Communications  Counterm^suresyilluly  31, 1992 


is  the  "Central  Manager"  of  the  Dll 


DiyiRD  91 8,  September  1992 


will  "in  consultation  with  the  Directors  of  the  DIA  ^ndNSA,  provide  technology  and 
services  to  ensure  the  availability,  reliability  and  maintainability,  integrity,  and  security  of 
Defense  Information,  commensurate  with  its  intended  use." 

#  V.,  I 

I  DoDD  8000.1  Defense  Information  Management  Progprn,,  October  27, 1 992 

will  "ensure  the  Dll  contairif  adequate  protection  against  attack."  I 

DoDD  TS  3600. 1 ,  Information  Warfare,  December  21 , 1 992 

'•S  ■ 

will  "assess  the  vulnerlbilities  of . . .  defense  information  systems"  and  to  "maintain  procedures 
to  ensure  a  capability  to  respond  to  identified  threats  and  assessed  vulnerabilities 


CJCS  MOP  30,  Command  and  Control  Warfare,  8  March  1993 
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DISA's  Assigned  DoD  Agent 

IW-D  Responsibilities 

I 

I-’’ 


Technical  Standards 
Training  and  Courseware 

DoD  Computer  Emergency  Response  (Also  Army) 

DoD  MLS  Program 

Goal  Secui’ity  Architecture 

Security  Architecture  and  ^hginderiiig^  Suppoit 

Standardized  Certification  and  Accrddkatfon  Policy 

Lead  Security  Officer  Program 

DoD  Open  IW  Contract  Vehicles 


Security  Product  Requirements  and  Development 
DoD  IW-D  Management  Planning  and  Management 
Dll  Protection  (IW-D  Operations) 
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Defense  Information 
Infrastructure 


Dll 


DISA 

DISANI 

Internal 

Systems 

liegaCenters 


f  GCCS 

DISA 

Managed 

3DN  Systerrs 

dsn 

DISN 


CINC*s 


Army 


DoD  Systems 


OSD 


Air  Force 


Navy 


lannes 


DISA  FACTS: 
WIEGACENTER  COMPUTERS 


rooms  or  the  space  of  over 
13  football  fields. 
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DISA  FACTS: 
DIGITAL  NETWORKS 


the  globe 


could  circle 
times  or  go  to  the 
moon  apd  back  21  times 
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Info  Warfare  (IW)  -  Defend 

4  Objective 


Assured  Information  3^p/ice 
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The  Defense  Information 

Infrastructure 


A  seamles%web  of 
communications  rietworksj 
computers,  software- 
databases.  applications.  . 
and  other  capabilities  that 
meets  the  information 
processing  and  transport 
needs  of  DoD  useri  in 
peace  and  in  all  crises, 
conflict,  humanitarian 
support,  and  Y&time  roles. 
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Threats  to  DoD  Networks 


THREAtS 


Foreign  Nations  May 
Conduct  Computer 
Exploitation 

Data 


«  ^  Intelligence  Malicious  Denial  of 
Corruption 


Non-Government  Jhreats  (Hackers, 
Terrorists,  Org|niied  prime) 


Software  Service 


HM. 
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HACKERS 


ESPIONAGE 


MALICIOUS  CODE 


s 
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Dll  Threats 


DESTRUCTION 


Intruder  Technical 

Knowledge 


Technical 

Knowledge 

Required 


exploiting  known 
vulnerabilities 
self  replicating  V 
code  ^ 


sweepers 


sniffers 


stealth 

diagnostics 


lob0 


back  doors 


hijacking 

sessions 


•  GUI 
packet 

spoofing 


disabling 

audits 


password 

cracking 


ppsword 

guessing 


Atlackers 
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Reported  Security  Incidents* 


,  incident  is  any  event  in  which  a  corpputer  system  is  attacked, 


intruded  into,  or  threatened  with  an  attack  or  intrusion. 
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Approach  To  The  Threat 


•  Tempest  Prograhi  «  Shrinking  budget 

•  Physical  Isolatiph  ^  Worldwide  pursuit  for 

•  Certified  Products  universal  connectivity 

.  Consolidating  of  DOD's 
information  infrastriicture 


Know  your 
vulnerabilities  andf 
operate  no  systeni 
with 

vulnerabilities 


.  Increased  reliance  on 
Commercial  Products 

Increased  reliance  on 
Commercial  Service 
Providers 


Absolute  protection 
Isldchnologically 
imi^oSsible 

‘t:  .  • 

Financially  Impossible 
to  buy  absolute 
protection  \ 


Knowyoti^ 
vulnerabilities,  operate 
with  them,  but  manage 
them 


Yes 


ft5S 
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Information  Warfare 


SSppis 

>pim 
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Defi 


ng 


yrhe 

New 

Battleground 


OISA IW  Missiorii 


I!  ;:'l-  '  -[f 


"...AS  CENTRAL  MANAGER  FOR  THE  M 


SHALL  ENSURE  THE  Dll  dONTAINS 

g  I  -rf  j;  '  I 

ADEQUATE  P^OTECTIOR  AGAINST  ATTACK." 

DOD  if 
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Information  Warfare 

Cyberspace 


The  electronic  environment  formed  by  the  a^regate  of 
global  computing  atid  telecommunications  resources. 


Cyberspaqe  is  a  virtual  5th  dimension  charact^f^ed  by: 
no  geographic,  national,  or  temporal  bouiidtries 


no  ownership,  laws,  or  identity^cards 


~»lll 


;'-x. 


"'.""^^wwawwwwflaww 
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Information  Warfare 

A  New  Reality 


mm 


.  Defense  information  is  a  target 
The  Dll  will  be  the  battlefield^ 


-  The  world  knows  we  are  depend^if  on 

information  for  our  s^te  of  vi^dr  \ 

-AdversarieSgal ready  hajye attack  capfibilities 
» Open  literiture  has  exitmples 
^  High  school  students  have  succeeded/ 

-  Low  cost/high  payoff 

-  Strategic  advantage  for  low  tech  armies 
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DISA  INFOSEC 
training 
programs 


PMOs: 

Dll 

EC/EDI 

GCCS 

DMS 

DISN 


DISA  INFOSEC/IW-D  program 
management  j  i 

Policy  . ’ . 

Plans 

Resources’  | 

Execution  J 

Coordination 

GCC/RCC  security  ma^gement 
operations 
ASSISTA^PI 


Strategic  Plans  Security;  engineering 


Secure  business 

systems 


WESTHEM 

KCC  operations 
DMC  operations 


CISS 


Assessments 

Training 
Security  and 
Certification 
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_  JITC 

integration  testing 


_  JIEO  I 

Security  architecture 
and  engineering 
Security  product 
integration 

INFOSEC  standards 
MLS 


IW-O  modeling 
and  simulation 
IW-D  impact 
assessments 


Security  for  the  Dll  provided 

thru  a  BALANCE  of: 


networks. 


critical 
and  facilities 


DETEG^ION:  DETECI" 
Dll  quickly  enough  to 
reactions 


at|agks  upon  the 
operational 


to 

attacks  to  either  defeat  them  or  maintain 
service 
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10,539 

SUCCESSFU 

ATTACKS 

\  (87.8%) 


401  NOT 

KAMBk  JWIMil  MMUl 

REPORTE 


SUCCEED 

_ .....  I..... . Li^ . . !... .  J 


UNDETECTED 


A- 


Red  Team  Assessment  of  DoD 

Security  Mechanisms 


Only  hacker  tools 
from  internet 
Only  known 
vulnerabilities 
Only  vulnerabilities 
covered  by  prior 
alerts 


Historical  Roles 


Encryption 
Passwords 
System  Isolation 


React 


Fault  Isolation 
Repair 

Performance  Balancing 
Backup  and  Recovery 
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Risk  Management  Philosophy  for 

Security  of  the  Dll 


Absolute  protection  of  the  entire  i 
Defense  Informatibndnfrastructure 
(Dll)  is  neither  technically  nor 
financially  achievable  Somebupber 
of  attacks  upon  the  will  succeed. 
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PROTECTION 


Program 


Secure  crjitieal  backbon^^rnrnunictions  rietwrark 
toiSN)  and  connection  to  it 


Secure  critical  military  applications: 

Global  Command  and  Cdnjtrbl  Sysjtem 
Defense  Messagining  System 

Business  processes  (finance, Inedical,  logistics'  personnel) 

#'  ^  ...  -  i: 

Secure  critical  processing  centers  (Defense  lyiegacenters) 
Train  and  equip  system  administrators  for  secure 


operations 
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DETECTION  Program 


meastjre  Dll  vulnerabilities  to  attack 


Develop  and  implerneM  detection 


Train  and  ec|uip 
detection 


attack 
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REACTION  Program 


Upgrade  Dl  I  Global  and  Regional  Control  Center 
System  by: 

►  Adding  attack  reco^ition  function 

«►  Adding  automated  infrastructure  reaction 
management  capability 

Train,  equip,  and'exercise  Global  and  Regional 

Control  Cent§f  personnel  in  defensive 
information  warfare 
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•  CONUS/DISN  Backbone 


.  OCONUS  Links 

•  NIPRNET 

•  SIPRNET 

•  JWICS  Infrastructure 


T8SkNiim6er2.I 

FY^; 

1  FY9f., 

FY98 

FV99 

FYOO 

FYOl 

Enciyptors  nid  Jhfairdwuc/ 

Softwue  to  S^tiiire  Networic 
M<nigem«!|:Cenlen 

Ptociire  Sccqjre  Nt^woik 

Sefven(S(^ 

DISN  CoHapsea  to'Single 

Networlf 

ftocdre  FORTEZZA  Cards 
and  Ceitifkalion  Authority 

Woiicatations  (CAWa) 

Procure  FORTEZZA+  Cards 
;and  Certification  Authority 
Workstations  (CAWs) 

Procure  PCMCIA  Card 

Readers 

••• 

'  - 

# 

• 

1 

- 
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Secure  the  Applications 

Global  Command  and  Control! 


S!sn/siprnS 


'foRcr 

STAtUd 


FORCE  ^ 
mpiommff 


EMPIOVMENT 


UNIRED 

COMMANDERS 


JOINT 

TASK 

FORCE 


SECDEF 


CRISIS 

PLANMiNO 


SUSTAININO  BASE 


Personnel 


Supply 


Medical 


Sendees 
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Secure  the  Applications 
Business  Applications  &  Users 


Medical  Personnel  Finance 


logistics 
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Secure  the  Applications 


•  MLS 


intOfGCCS 


Task  Number  4.1 

FY96 

FY97 

FYS« 

FY99 

FYOO 

FYOl 

Procure  and  Inatall  Multi- 

"  ■ 

■■■  V. 

Level  Security  (MLS) 
Workitationa,  Trusted 

Operating  Sy  stems  arid 

Trusted  Servers 

V 

1 

1 

\ 

Procure  and  Install  Imagery 
Guard  and  GCCS/GCCS-T 

Guard 

Procure  and  Install  GCXS 

^  1 

Intelligence  Workstation 

Port  GCCS  MLS  Software  to 

HP  Workstations 

O  ft  M  for  Fielded  Systans 

and  Upgrading  to  New 
Technology 
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Secure  the  Applications 


APIs  for  Business  Systems 


DMS 


Task  Number  4.3 

f  FY96 

.s  hJ 

■  FY97 

,  "fY98  : 

i  FY99 

FYOO'  . 

FYOl 

« 

DMS  Implementation 
(Sensitive  but  Unclassified) 

DMS  Implementation 
(Unclassified  to  Secret) 

DMS  f 

(interim  Top  Secret/SCI)  J'' 

Autodin  Phase  Out 

Pull  Multi-Level  Secure 

Operations 

M. 

1 

*1; 

JLk. 

.<<>■ 

■y^ 

iiic  I^IVIJ  riiiuiiig  ucpiciea  aoovo  is  oasea  on  me  UMS  Migration  Strategy  as  oTT8  Odober  and  it  under - ■'  ■  - ' 

control  of  the  DMS  PMO  It  is  provided  as  a  of  this  IN  POSEC  Plan  for  informabon  purposes  The  Joint  Staff 
approves/disapproves  shutdown  of  individual  AUTODIN  Switching  Centers  (ASCs)  on  a  yearly  basis. 
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Secure  the  Defense  Megacenters 

•ii  •  '''v 

. ,5  DMCs_^  j  :  . 


•  Integrate  MISSI  Techriblogies 

•  Standardize  Environment 

•  Certification 

•  Vulnerabilities/ 

.  Security  Deficiencies 


T&k  Number  3*  1 

ky96 

iFy97 

FY9J 

FY99 

FYOO 

• 

FYOl 

DlidC  -  Columbus  EOP 

MVS  Systems 

Unisys  Systems 

UNIX  systems 

Other  Systems 

Maintenance 
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Operate  and  Manage 

a  Secure  Dll 


Train  Personnel 


Certification/Accreditation 


Measure 

Vulnerability 
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Operate  and  Manage  a  Secure  Dll 


Certification  &  Accreditation 


Training 
Red  Team 


Task  Number  53.2 


Global  C2  System 

Defense  Megacenters 
Certificatrion/Rccertificaldon 

DISA-EUR 


Security  &  Ops. 
Mgmt.Integ.  I 


DtSA-PAC 


JIlPRNET 

NIPRNET 

DISANet 

Other  DISA  Systems 

DoD  Certification  Support 
(e.g.,TACCIMS,EKMS) 


FY96  FY97  FY98i  FY99  FYOO  FYOl 
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Global  Control  Center 
Regional  Control  Center 
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Goal  of  Global/Regional 

Control  Centers 


Significant  imprdvementfln  military  read inesis  and 
war  fighting  capability  ^ 

►  Ensuring  availability  of  information  services  by 

preventing  or  operationally  reacting  to 
comrrion  information  systeni  adapks 

►  Ensuring  the  confidentiality  and  integrity  of  all 

DoD  complunications  and  businesses 
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strategic  Objectives 


toCINCs 

Battlespace  Management  (DISA  is  Cybflspace 
Warfighter) 

Integration  into  Worldwide  Warniii  Indicator 
Monitoring  System  (DIA  Sdpport) 

Integration  'Jit©  Naticnal  Military  Command  and 
Control  System 

Tie  to  National  SIGINT  Operations  Center 
(NSA  Support) 
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Center  Connections 


CONORS 
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Global/Regional  Control  Center 

A  Functioning  View 


•  Audit  data  collection  Points 
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Hierarchal  ‘Relations 
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Global  Control  Ceri 


GCC/RCC  Functions 


Vulnerability  Detection  (Continual  VAAP) 


Attack  Recognition  (AmidS) 

Prioritized  Responses  (AIMS) 

Customer  Support  (BBSs/A|erts/tobls) 

CINC  Support  Team 
IW-D  Battlespice 
Wargames  and  Exercises 
Incident  Response  (DoD,  National,  International) 
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GCC/RCC  Requirements 


Audit  Morpitoring/IntrusiQn  Detection  (AM IDS), 


Malicious  Code  Detection#Eradication  (h&DES), 
Automated  Infrastructure  Management  (AIMS) 
Vulnerability  Analysis  (VAAP) 

( 

Personnel,  Training,  and  Facilities 
Wargames  and  Exercises 
Reserve  Corriponents 
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Audit/Monitoring 
Intrusion  Detection  System 


Mainframe 


PC 
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Network  Nodes. 


Addit  data 
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Servers 


Data 

Reduction 

Threshold 
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Audit  Monitoring/ 
Intrusion  Detection  System 


Detect  u  na  uthorized  activity  as  it  occurs 


I 


Ml: 


•  Intrusions  1 

•  Password  Attacks 

•  Increased  Privilege 

■  Disabling  of  Audits 

•  Denial  of  Seh/ice 
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Virus  i  ntrod  uced 
into  computer 
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Malicious  Code  Detection/ 
Eradication  System 


'W 
ills 


i  Detection  Eradication 

Normal  Operation^ 


Cm  W 


Malicious  Code  Detection  Eradication 

Contingency  Operations 


Malicious  Code  Detection 


Eradication  System 


Detect  Irregular  Code 


.  Viruses 

•  Troian  Horses 

•  Time  Bombs 

•  Spoofing  Toqll 

•  Sniffers 
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Develop  Acquisition, 
Maintenance,  and 

Distribution  Concept 

Identify,  Evaluate,  and  Select 
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Acquire  Hardware/Softtvare 
for  MODES 

Modify  and  Enhance 

MODES 

Maintain  MODES 
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•FV96  activities  conducted  with  Government  manpower  and  resources 
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IW-D “REACT” 


Example  Responses 

■  Alternate  Network  Routing 
Prioritized  Network  Service  Levels 

^  Move  Service  From  Digital  Networks  To  Satellite 
System^. 

^  Frequency  Refallocation  ij  ® 

^  Communication^  Isolation  1 ;  ;f 

•  Response  Team  DispatoM  ' 

•  Fall  Back  Pipcessing 

•  NSEP  Activation 

•  "Patch"  Development  and  Deployment 
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Automated  Infrastructure’ 
. -g.- _ Management 


and  Control  th^  Dll  Under  Attack 


•  Terrestial/Satellite 

I 

•  Isolation 

•  Restoral 

.  Alternate  Routing 

•  Fallback  Processing 
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Investigate  Existing 
Capabilities 

Select,  Modify,  and  Integi 
AIMS 
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*FY96  activities  conducted  with  Government  manpower  and  resources 
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Vulnerability  Analysis  and 
r  Assessment  Program 


Detect  Potential  Problems  in  Systems 


.  Assesments 

•  Components 

•  Procedures 

•  Facilities 

•  Personnel 
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Personnel  and  Training 


Prepare  people  to  Siwpport  GCC/RCC 


Examples 
•  Info-warrior 


•  Retrain 


•  SCI  Cleared 


Task  Numbci*  5  5. 5 

B  FY96 

FY97 

FY9& 

.  FY99 

FYOO 

FYO  1 

Retrain  RCC  Specialists 

Maintain  the  Facilities  an( 

Technical  Proficiency 
Training  Progrmri  ^ 

/  \ 

/V- 

j  Z_T^ 

V 

\ 

• 

200  Security  j%rsonnel 

Reserve  Components  Utilization  Plan 
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Facilities 

People  &  Faeilities  to  Support  GCC/RQQ 
Examples 

•  SCIF  is  Required 

•  Backup  Site 

•  Power  (UPS)  f 

•  Equipment  (AIS/Housekeeping) 

•  Communications  (New/Redundant) 


Task  Number  5.5. 5A 

FY9e 

FY97 

EY98 

#¥99 

FYOC 

'  FYOl 

Prepare  GCC  and  RGCs 
Facilities  to  Provide  fW-D 
Detect  and  React 

Build  Gut  Facility 

Incorporate  GII  View  Into 
GCC  and  RCCs 

UCC 
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Wargames  and  Exercises 

Practice  and  T est  Plans 

Ex^pip^es 


•  Red  Team 

•  Prototype 

•  Implement 

•  ^xer°  se 


1^04/1995 
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Reserve  Components 


•  ■  n<‘  - 


Augment  with  Experts 


Peacetime  Tests 


Contingency 


Expertise 

Pra<^ce 


Develop  CONOPiS  and '  ^ 

Realign  Reserve  Utilization  n 
DISA  for  rW.D/lNFOSEC 
Support 

Provide  Increased 
D/INFOSEC  Support  tb 
GCC/RCC/DMCs  and  MST: 
in  Peacetime,  Exercise  and 
Contingency  Crisis 
Operations 


I  activities  cond 


FIY98 

FY99 

FYOO 
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ovemmem  manpower  and  resources 
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General  Security  Support 

I  Ilf"" 


Exarnpjis 

■  ■ 

.  Architecture  and  Engiiieering 


.  Standards 
.  Testing 
•  Tech.  Insert. 

Modeling  &  SJm. 


Task  Number  6.4  | 

E  Y  9 

5  E  Y  9 

1  |V98 

FY99 

FYOO 

FYOl 

Frame  the  Problem  "i 

Develop  Rapid  Prototypes 

V 

\ 

Make  Simple  Modifidiation  to 

Existing  Models  ji  , 

Awr-m 

Develop  and  Integrate  IW 

Modules  with  Existing  C4I 

Jk - 

- 1:^ 

Simulations 

Prototype  IW  Modules  for 

"1 

GCCS  Training  Environment 

- j 
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INVESTMENT  Program 


Research  and  developrnent  to: 


Maintain  technological 
products 


"security 


Develop  new  security  products  for  digital  networks: 

Replaceanalogsecure  (STU-l1l)%^ith  digital 

secure  telephone  (STE) 

►  Secure  digital  clllular  (wireless)  telephone  capability 

►  Secure  high-capacity,  digitai  broadcast  capability  for:4actical 

forces 


Information  Warfare 
Response  To  A  Mew  Reality 


^1 


Defense  planning  must^reflect  anticipated  realities 

-  Battle  damage  assumed,  operation  under  stress 

-  Response  procedures  and  recovery  capacity 


•  Priorities  must  be  properly  ad[dre§sei|: 

-  Infrastructure  '  I  " 

-  Operations 

Criticality  of  information  must  be  understood 

-  Operationai  ne^d/impact  of  loss  -  time  criticai  , 

•  We  must  train  for  defensive  information  warflire 

* 

-Train  information  warriors 

-  Hoid  wargames,  readiness  driiis  and  exercises 
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